> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/windows/deploy-aikido-endpoint-with-workspace-one.md).

# Deploy Device Protection with Omnissa Workspace ONE

Use Omnissa Workspace ONE to deploy Aikido Device Protection across your managed Windows fleet with the required permissions in place.

{% hint style="info" %}
All devices must be enrolled in Omnissa Workspace ONE Windows management before you begin.
{% endhint %}

## Installation

{% stepper %}
{% step %}
**What you'll need**

Before starting, make sure you have the following from the Aikido Device Protection dashboard:

* Your **PowerShell install command** (copied from the user group selector on the dashboard, includes token + installer download)

If you're missing it, go back to the [Aikido Device Protection dashboard](https://app.aikido.dev/endpoint-protection/devices), click **Connect Device**.
{% endstep %}

{% step %}
**Run the install command on managed devices**

1. In the Workspace ONE UEM console, go to **Resources** → **Scripts**.
2. Click **Add** and select **Windows** from the drop-down.
3. On the **General** tab, give the script a name (e.g. "Aikido Device Protection Install").
4. On the **Details** tab, set **Language** to **PowerShell** and **Execution Context and Privileges** to **System Context**.
5. Paste the PowerShell install command you copied from the Aikido dashboard into the script body.
6. On the **Assignment** tab, assign the script to the target Windows smart group and set the trigger to run on the next sample.
7. Click **Save**.
8. From the script's row in **Scripts**, click **More** → **Run Now** on a test device first and confirm a successful execution status before rolling out.

{% hint style="info" %}
Scripts require Intelligent Hub on the device. Check deployment status under **Devices** → **List View** → device → **More** → **Scripts**.
{% endhint %}
{% endstep %}

{% step %}
**Apply the lockdown policy**

Workspace ONE does not expose a single toggle that blocks stopping a specific Windows service. Combine the two controls below to harden the agent against tampering.

Create two separate Workspace ONE profiles -- one to block uninstallation using AppLocker, and one to restrict access to the Windows Services console.

**Block uninstall of the Aikido Device Protection application**

1. In the Workspace ONE UEM console, go to **Resources** → **Profiles & Baselines** → **Profiles**.
2. Click **Add** → **Add Profile**, then select **Windows** → **Windows Desktop** → **Device Profile**.
3. Select the **Application Control** payload. Application Control uses Microsoft AppLocker to prevent users from adding or removing applications.
4. Paste the contents of [aikido-applocker-deny-mdm.xml](https://raw.githubusercontent.com/AikidoSec/safechain-internals/refs/heads/main/docs/aikido-applocker-deny-mdm.xml) into the Application Control payload (open the link, copy the full XML text, and paste it here).
5. Assign the profile to the same smart group and click **Save & Publish**.

**Restrict access to the Services console**

1. Create a second profile: go to **Resources** → **Profiles & Baselines** → **Profiles**, click **Add** → **Add Profile**, then select **Windows** → **Windows Desktop** → **Device Profile**.
2. Select the **Custom Settings** payload.
3. Paste the following SyncML block into the Custom Settings payload:

   ```xml
   <SyncML>
     <SyncBody>
       <Replace>
         <CmdID>1</CmdID>
         <Item>
           <Target>
             <LocURI>./Device/Vendor/MSFT/Policy/Config/ADMX_MMCSnapins/MMC_Services</LocURI>
           </Target>
           <Meta><Format xmlns="syncml:metinf">chr</Format></Meta>
           <Data><disabled/></Data>
         </Item>
       </Replace>
     </SyncBody>
   </SyncML>
   ```
4. Assign the profile to the same smart group and click **Save & Publish**.

{% hint style="info" %}
The Aikido Device Protection installer also applies a service ACL that prevents standard users from stopping the `EndpointProtection` service directly. The Workspace ONE controls above add a second layer by stopping users from reaching the uninstaller or the Services console.
{% endhint %}
{% endstep %}

{% step %}
**Reboot devices after installation**

1. In the Workspace ONE UEM console, go to **Devices** → **List View**.
2. Filter to the target smart group, then select devices using Shift-click. (Avoid the global checkbox -- bulk actions may not trigger correctly with it.)
3. Click **More Actions** → **Restart Device** and confirm.

The agent fully activates on the next boot.
{% endstep %}
{% endstepper %}

## Troubleshooting

| Problem                                                      | Fix                                                                                                                                                                             |
| ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Device doesn't appear in the dashboard after the script runs | Reboot the device; the agent fully registers on the next boot                                                                                                                   |
| Script exits with an error in the MDM console                | Run the script manually as SYSTEM on a test host to see the full error; confirm the device has internet access to download the installer                                        |
| Agent service is not running                                 | Reboot the device; if the service is still absent, re-run the install script                                                                                                    |
| Script is blocked by execution policy                        | Scripts run via MDM execute as SYSTEM and bypass user-level execution policy restrictions; confirm the MDM is not applying an additional policy that restricts script execution |
| Device shows as inactive after installation                  | The agent needs a reboot to fully activate; check back after rebooting                                                                                                          |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/windows/deploy-aikido-endpoint-with-workspace-one.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.